1. Field of the Invention
The present invention relates to computer networks in general and in particular to detecting and managing malicious traffic in said computer networks.
2. Prior Art
The worldwide web (WWW), better known as the Internet, is fast becoming the premier computer network for communicating both private and public information. The Internet is an open network that can be accessed by anyone using primarily a protocol called TCP/IP (Transmission Control Protocol/Internet Protocol) or other protocols. Because of its openness computers on private networks (intranets) are susceptible to malicious attacks by hackers. Computers have become the main instrument of communication for business and government agencies. For example, many business and government agencies use computers and computer networks to link remote offices, share data and other resources among employees within an office or campus, communicate with customers via electronic mail, reach new customers via electronic mail, provide information via web sites, etc.
Because businesses, governments and individuals rely heavily on computers and the Internet malicious attacks could result in catastrophic economic loss or embarrassment. As a consequence computer security has become a major concern of business, government and individuals using the computer as a major communication vehicle.
There are several ways in which hackers may elect to inflict malicious attacks on computers. One way is to disrupt computers' operation by disseminating programs that take unauthorized control of a computer's operating system. Another way is to discover confidential information about assets in the computer or a subnet in the network for the purpose of deleting data, modifying date and/or copying data. Any of these actions could adversely affect a home, business, or governmental agency network.
There are several techniques used by hackers or attackers to gather information on network devices. Port scanning is one of the techniques used by hackers or attackers to gather information relative to one host or several hosts. When several hosts are involved the technique is referred to as Distributed Port Scanning. With port scanning, the hacker uses legitimate TCP/IP (Transmission Control Protocol/Internet Protocol) commands to gather information. In this regard the hacker issues a SYN (Synchronize) packet masquerading as a station wishing to initiate a TCP session. Alternatively, the hacker may issue an RST packet. In either case the hackers hope a non-suspecting host responds with packets from which information about the host can be gleaned. There are many other combinations that can be used for port scanning. Such combination includes SYN/ACK, FIN, Null Christmas tree packets, etc. In fact, any protocol requiring a response may be used for port scanning.
The prior art has recognized the importance of computer networks and has provided intrusion detection systems to protect them from hackers. Examples of prior art detection systems can be found in U.S. Pat. Nos. 6,405,318; 6,363,489; 6,477,651; 6,279,113; 6,282,546; 5,991,881; 6,338,141; 5,414,833; and 5,983,348. Even though the Intrusion Detection System (IDS) described in each of the patents works well for its intended purpose it does not work well in detecting scanning activities.
It is believed the inability of prior art IDS to detect scanning of the network is based on the fact that they use a library of known patterns of header values or payload bytes. Packet headers or payloads in received packets are compared to known patterns which can be regular expressions or fixed values. The drawback with this approach is that such libraries cannot fully include reconnaissance or scan patterns not seen before. As a consequence some prior art IDS cannot protect against novel reconnaissance traffic.
Even the IDS technologies that boast the ability to detect scanning only mean that they can discover if many packets (some threshold) have been sent to a single destination address. They are unable to correlate scans using fewer packets (than the threshold) and further hampered when multiple destinations and formats are used.
In view of the above, prior art techniques and apparatus do not provide the network administrator with sufficient power to defend a computer network against reconnaissance or scan traffic. As a consequence a system and method, such as those described herein, are required to provide the additional protection.